Browse / Helium

Helium

See its reports on the map

Attack surface: 298 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Helium

• Access Control2
• Insecure Direct Object Reference2
• Injection and Smuggling1
• Authentication1
• Information Disclosure1
• Business Logic1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. HTTP request SmugglingHTTP Request Smuggling · high
   300 votes
2. Organization TakeoverImproper Access Control - Generic · high
   $500263 votes
3. Account takeover w/o interaction for a user that doesn't have 2fa enabled via 2fa linking and improper auth at /api/2fa/verifyImproper Authentication - Generic · medium
   92 votes
4. Cleartext Transmission of Sensitive Information Leads to administrator accessCleartext Transmission of Sensitive Information · medium
   89 votes
5. Race Condition of Transfer data Credits to Organization Leads to Add Extra free Data Credits to the OrganizationBusiness Logic Errors · medium
   $25074 votes
6. SSRF By adding a custom integration on console.helium.comServer-Side Request Forgery (SSRF) · high
   54 votes
7. Organization Takeover via invitation APIInsecure Direct Object Reference (IDOR) · medium
   $10040 votes
8. Hyperlink Injection on Email InvitationOpen Redirect · low
   $5025 votes
9. unpermitted user can change the device name of admin accountUncontrolled Resource Consumption · high
   23 votes
10. Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpointPrivilege Escalation · medium
    21 votes
11. Read-Only user can delete usersInsecure Direct Object Reference (IDOR) · high
    19 votes